Version 2

Privacy Policy

Published English edition

1. Scope

This Policy explains how ICLICK INTERACTIVE ASIA LIMITED (the “Platform”, “we”, “us” or “our”) collects, uses, stores and shares your personal information when you use the MIA Platform and the MIA Points top-up and usage services.

This Policy applies to all users who access the Platform services through the Platform website, APIs or related clients. If you do not agree with this Policy, please stop using the Platform services.

This Policy and the MIA Platform and MIA Points Terms of Service together form the contractual basis for your use of the Platform. Please read both documents carefully.

2. Information We Collect

2.1 Information You Provide

Account registration information: This includes your email address, username, profile photo and any other account information you choose to provide.
Payment information: When you top up, your payment information is collected and processed directly through Stripe-hosted checkout. The Platform does not receive or store your full payment-card number or bank-account number. The Platform retains only the transaction identifier, amount, status and other information necessary for the transaction returned by the payment channel.
AI feature inputs and related content: This includes prompts, files, instructions and other content that you submit when using the Platform’s AI features. See Section 2.4 for further details.
Support communications: This includes correspondence generated when you contact the Platform by email.
Refund and payment-dispute information: This includes the application information, reasons, relevant transaction information and necessary supporting materials you provide when requesting a refund or handling a chargeback or other payment dispute. Refund requests are handled in accordance with the applicable MIA Points Refund Policy.

2.2 Information Collected Automatically by the Platform

Account and transaction records: This includes top-up order information (amount, status, timestamp and payment channel), Points balances and lot records, and Points consumption records (see the special notice in Section 2.3 below).
Service access logs: This includes request timestamps, the relevant feature or product identifier, and the IP address of the service making the request. For API calls received by the Platform, this IP address is generally the IP address of the calling server rather than that of your personal device.
Authentication and security-event logs: This includes login events, token issuance and revocation, and session activity used for account-security checks.
Connection and API-access records: If you create a personal access token or Platform Key, or authorise a third-party tool to connect to your account, the Platform processes information necessary for the authorised account, permission scope, token issuance and revocation status, call activity and Points usage. A third-party tool may access information only within the scope you authorise.
Telemetry data: This includes aggregated statistics on the use of product features for monitoring and improving service quality. The Platform’s telemetry contract expressly prohibits personal contact information from being included in telemetry events.

2.3 Points Consumption Activity Logs — Special Notice

MIA Points are prepaid digital-service credits. If a payment dispute arises, records showing the actual consumption of Points are key evidence that the Platform may provide to a bank to demonstrate that the service was delivered (corresponding to Stripe’s `access_activity_log` dispute-evidence field). The Platform therefore maintains separate consumption activity logs, independently of its general telemetry systems, containing:

account identifier;
precise timestamp of consumption;
number of Points consumed;
relevant product or service identifier;
caller IP address, if available (the IP address of the server calling the Platform API, rather than the end user’s personal IP address); and
associated Points-ledger transaction ID.

These logs are retained for at least 400 days from the date of consumption (see Section 5) to cover the dispute-acceptance periods of international card schemes.

2.4 Inputs You Submit and Generated Results

Inputs you submit when using the Platform’s AI features (including prompts and files) and the results returned by the model are transmitted by the Platform to a third-party model provider for processing. The Platform does not use such content to train AI models (see Section 3) and does not unlawfully provide it to other parties.

To provide features such as conversation history, cross-session memory, file management and generated results, the Platform stores the relevant content for the life of your account or for as long as necessary to provide the relevant feature. You may request access, correction or deletion as described in Sections 9 and 12. The applicable retention and deletion rules are set out in Section 5.

To demonstrate service delivery to a card issuer, the Platform records only consumption metadata (time, quantity and product identifier) in its consumption activity logs and does not record the text of inputs or outputs in those logs.

2.5 Risk Signals and Tags

If the Platform’s risk-management system flags your account as suspicious (for example, because of unusual top-up patterns or suspected multi-account abuse), the Platform records the relevant signal tags, the type and value of the triggering signal, the operator and the time of the action. These flags are for monitoring purposes and do not currently result in automatic account suspension, but they may inform a manual review decision.

3. Purposes and Legal Bases for Processing

The Platform processes your personal information for the following purposes:

Providing the Platform, AI features, and Points top-up and usage services: We process account information, content you submit and generated results, payment-transaction records, Points balances and service-usage records. The legal basis is performance of a contract.
Providing conversation history, cross-session memory and file-management features: We store and retrieve conversations, memories, files and generated results associated with your account. The legal basis is performance of a contract.
Providing Connections and API access: We process authorisation scopes, access-credential status, call records and relevant account information so that a tool you authorise may call Platform features on your behalf. The legal basis is performance of a contract.
Handling refunds, substantiating disputes and managing risk: We process refund-request information, consumption activity logs, risk tags and transaction records. The legal basis is performance of a contract or our legitimate interests in processing refunds, preventing fraud and protecting contractual rights.
Account security: We process authentication logs and device signals. The legal basis is our legitimate interest in protecting user accounts.
Service-quality monitoring and improvement: We process aggregated telemetry data. The legal basis is our legitimate interest in improving product performance.
Compliance with legal obligations: The types of information processed depend on the applicable legal requirement. The legal basis is compliance with a legal obligation.
Customer support: We process communications and account information. The legal basis is performance of a contract or our legitimate interests.

Model training: The Platform does not use your personal information, or content you submit or generate through the Platform, to train artificial intelligence models. If this practice changes, the Platform will notify you in advance and obtain your consent where required by applicable law.

4. Sharing of Information

The Platform does not sell your personal information. The Platform may share necessary information with third parties in the following circumstances:

4.1 Payment Processor

Stripe, Inc. (United States): As the Platform’s payment processor, Stripe collects and processes your payment information through its hosted checkout and returns payment-result notifications to the Platform. Information involved includes the transaction amount, payment-method type, transaction identifier and information independently collected by Stripe for fraud-prevention purposes. See Stripe’s Privacy Policy at <https://stripe.com/privacy>.

4.2 Model Provider

The Platform provides AI features by calling the API of OpenAI, L.L.C. (United States). To complete a task you initiate, your inputs, including prompts, files and context necessary to complete the task, are transmitted to the provider for processing, and the provider returns the generated result. Our agreement with the provider prohibits it from using such content for model training. The Platform need not disclose specific model names or versions for the purpose of this notice. If there is a material change to the model provider, the Platform will update this Policy or otherwise notify you as required by law.

4.3 Other Service Providers and Third-Party Tools You Authorise

The Platform may also engage the following service providers to process information necessary to provide the services:

Amazon Web Services, Inc. (AWS): The Platform uses a service region located in Singapore to host the Platform and store online Platform data, including account, order, Points, log and telemetry data.
Cloudflare, Inc.: Cloudflare processes access IP addresses, TLS information and request metadata through global edge locations for content delivery, edge protection, traffic access and rate limiting.
Google LLC: Google processes account identifiers, email addresses, names, profile photos and other information necessary for Google sign-in. The Platform also uses Google Workspace to send login codes, authorisation links and account or support emails.
Microsoft Corporation: Microsoft processes account identifiers, email addresses or UPNs, names and other information necessary for Microsoft sign-in and identity verification through Microsoft Entra ID.

The Platform provides these service providers only with the information necessary for them to perform the relevant service and requires them, through contracts or other appropriate measures, to protect personal information appropriately. Depending on their infrastructure and service arrangements, their processing may take place in other countries or regions in which they operate.

If you actively authorise a third-party tool to connect to the Platform or use an access credential you create, the tool may obtain or submit relevant information within the scope you authorise. Disconnecting the tool or revoking the credential stops future access through that connection or credential. However, information previously obtained by the Platform or the third-party tool for business purposes such as service delivery, security, compliance or dispute handling may not be deleted automatically and will be handled in accordance with this Policy or the third party’s applicable privacy rules.

4.4 Legal Requirements

The Platform may disclose necessary user information where required by applicable law or a lawful direction from a competent authority. To the extent permitted by law, the Platform will endeavour to notify you in advance.

4.5 Corporate Transactions

If the Platform is involved in a merger, acquisition or asset sale, user information may be transferred as part of the transaction. The Platform will notify you in advance and ensure that the recipient assumes an equivalent level of privacy protection.

5. Data Retention

The Platform retains different categories of data as follows:

Account and profile information: Retained for the life of the account. After the Platform receives and approves an account-closure or deletion request, authorised operations or engineering personnel delete or anonymise account information such as the name, email address and profile photo, except where retention is required by law or necessary for security or dispute handling.
Points consumption activity logs: Retained for at least 400 days from the date of consumption to cover payment-dispute windows of international card schemes. The logs are deleted when that period expires, unless a dispute, legal-retention requirement or other necessary circumstance applies.
Top-up orders, refunds and payment-dispute records: Retained for the life of the account and for seven years after account closure to meet business-record retention requirements under the Hong Kong Inland Revenue Ordinance. Materials submitted as attachments to support communications generally follow the retention period for support communications; if they relate to an unresolved dispute, they may be retained until the dispute is resolved and the applicable retention period expires.
Authentication and audit logs: The audit ledger is append-only and is retained until the relevant legal and security-compliance requirements expire. Session information is retained only for as long as necessary to maintain a valid session. Relevant OAuth authorisation information is deleted when authorisation is revoked or the account is deactivated, except for necessary audit records.
Connection and API-access records: Access credentials and authorisation status are processed for the life of the account or while the relevant connection remains active. Revocation or disconnection stops future access. Related call, security and audit records follow the applicable retention periods for Points consumption activity logs or authentication and audit logs.
Telemetry data: Raw telemetry data is retained for 90 days, the shortest practicable period needed for service-quality monitoring, and is deleted when no longer required. The Platform may retain aggregated statistics that no longer identify an individual.
Support communications: Retained for three years after the matter is closed for dispute handling and compliance.
Inputs, conversation history, cross-session memory, files and generated results: Retained for the life of the account or for as long as necessary to provide the relevant feature. After the Platform receives and approves a deletion or account-closure request, authorised operations or engineering personnel delete or anonymise the relevant content, except where retention is necessary for account security, dispute handling or compliance with legal obligations.
Risk tags: Retained for the life of the account. Necessary records of the removal or modification of a tag may be retained while they remain necessary for anti-fraud, security or dispute-handling purposes.
System backups: Personal information in backups is minimised and retained for the shortest period necessary for backup restoration, system security and business continuity, and is deleted through backup-overwrite or clearance processes when no longer required.

When an applicable retention period expires, the Platform deletes or anonymises the relevant personal information unless continued retention is required by law.

6. Data Security

The Platform applies the following technical and organisational measures to protect your information:

Payment-data isolation: Sensitive payment information, such as card numbers, does not pass through the Platform’s servers. It is processed and tokenised directly by Stripe, and the Platform stores only tokens.
Credential hashing: Personal access tokens (PATs) and Platform Keys are stored only as hashes. Plaintext is returned once when a credential is created and cannot subsequently be recovered.
Encryption in transit: All data in transit is encrypted using TLS.
Access controls: Role-based access controls apply to sensitive operations, and all operator actions are recorded in an append-only audit log.

Although the Platform applies these measures, no internet transmission or electronic-storage method can be guaranteed to be absolutely secure. If a personal-information breach, alteration or loss occurs, the Platform will notify affected users and competent supervisory authorities within the time limits required by applicable law.

7. Cookies and Similar Technologies

The Platform does not use advertising, analytics or behavioural-tracking cookies, does not integrate third-party analytics tools, and does not use cookies to track your activity outside the Platform. The Platform uses only first-party cookies that are strictly necessary to operate the services, for the following purposes:

Maintaining sign-in status: Recognising your signed-in status during a valid session so that you do not need to sign in repeatedly.
Protecting account and sign-in security: Verifying the source of requests during sign-in and authorisation flows to prevent attacks such as cross-site request forgery.
Resuming authorisation flows: Recording the status of an authorisation flow you initiate so that it can resume automatically after you complete sign-in.

These cookies carry the Secure flag, are subject to restrictive SameSite attributes, and expire when the session ends or the relevant flow is completed.

Third-party cookies: When you top up, you are redirected to a Stripe-hosted checkout page, where Stripe may set cookies on its own domain for payment processing and fraud prevention. If you choose to sign in with Google or Microsoft, the relevant identity provider may also set cookies or use similar technologies on its own domain to complete authentication, protect sign-in security and prevent abuse. These technologies are managed by the relevant third party under its privacy policy and are not controlled by the Platform.

Because these cookies are strictly necessary to operate the relevant services, disabling them will prevent you from signing in or completing a top-up.

8. Minors

The Platform does not provide services to users under 18 years of age and does not knowingly collect their personal information. If the Platform learns that it has collected a minor’s personal information, it will promptly delete the relevant data and close the account. If you are the guardian of a minor and believe that the minor has registered an account, please contact us using the details in Section 12.

9. Your Rights

You have the following rights in relation to your personal information, subject to the applicable law of your jurisdiction:

Access: Request a copy of the personal information held by the Platform.
Correction: Request correction of inaccurate or incomplete information.
Deletion: Request deletion of your personal information where no legal-retention obligation applies.
Account closure: Request closure of your Platform account. After the request is received and approved, the Platform deletes or anonymises relevant account information and content as described in Section 5.
Objection or restriction: Object to processing based on legitimate interests or request that processing be restricted.
Portability: Obtain information you provided in a machine-readable format.
Withdrawal of consent: Where processing is based on your consent, withdraw that consent at any time. Withdrawal does not affect the validity of processing carried out on the basis of consent before the withdrawal.

To exercise any of these rights or request account closure, submit a request using the user-rights contact details in Section 12. The Platform will respond within 15 business days after receiving the request. If more time is required, the Platform will explain the reason. To protect account security, the Platform may verify your identity before processing a request.

Please note: Points consumption activity logs serve a legitimate dispute-evidence purpose, and the Platform may be unable to comply with a request to delete those logs before the applicable retention period expires. Financial and tax records are also subject to statutory retention periods.

10. International Data Transfers

The Platform’s servers and data processing may involve storing or processing data in jurisdictions outside mainland China. In particular:

the Platform operator is incorporated in the Hong Kong Special Administrative Region of China;
the Platform uses cloud infrastructure located in Singapore to provide the Platform services;
the payment processor, Stripe, Inc., operates in the United States and other countries; and
the Platform’s model, authentication, email-delivery and content-delivery providers may process necessary information in the United States and other countries or regions.

The Platform applies appropriate safeguards to international data transfers in accordance with applicable law. You may use the privacy contact details in Section 12 to request the current list of overseas recipients. Special provisions for users in mainland China are set out in Section 13.

11. Changes to this Policy

The Platform reserves the right to amend this Policy. If a material change is made, the Platform will provide notice through the Platform or by sending a notice to your registered email address. Your continued use of the Platform services constitutes acceptance of the amended Policy.

This Policy was last updated on 18 September 2026.

12. Contact Us

If you have any questions, comments or complaints about this Policy or the Platform’s processing of personal information, please contact:

Data Controller: ICLICK INTERACTIVE ASIA LIMITED
Privacy Lead / DPO: Carl Hu
Privacy Contact Email: [email protected]

To exercise any of the rights described in Section 9, request deletion of personal information or close your account, please contact:

User Rights Contact: Charlie Li
User Rights Contact Email: [email protected]

Registered Address: Unit B, 18/F, MG Tower, 133 Hoi Bun Road, Kwun Tong, Kowloon, Hong Kong

13. Special Provisions for Users in Mainland China

This Section applies to users located in mainland China. Under Article 3(2) of the Personal Information Protection Law of the People’s Republic of China (the “PIPL”), although the Platform is incorporated in the Hong Kong Special Administrative Region, the obligations described in this Section apply because the Platform provides services to natural persons in mainland China. If this Section conflicts with another provision of this Policy, this Section prevails with respect to users in mainland China.

13.1 Notice and Consent for the Processing of Personal Information

The Platform processes your personal information in accordance with Article 13 of the PIPL. In particular:

processing that is necessary to conclude or perform a contract to which you are a party, including providing accounts, AI features, Points top-up and usage, authentication, Connections and API access, customer support and refund services, is carried out under Article 13(2) without obtaining separate consent for such general processing. Where personal information is provided outside mainland China, the Platform will nevertheless comply with the applicable notice, separate-consent and other obligations described in Section 13.3;
processing necessary to comply with a legal obligation is carried out under Article 13(3); and
for other processing based on your consent, you may withdraw your consent at any time.

13.2 Sensitive Personal Information

Payment-related information may constitute sensitive personal information under Article 28 of the PIPL. The Platform processes such information only to complete a top-up transaction you initiate, handle refunds and payment disputes, and meet anti-fraud obligations. The Platform processes such information only for a specific purpose and where strictly necessary, and applies stringent protective measures.

Please note: Complete payment credentials, such as full card numbers, are collected directly by Stripe through its hosted page, do not pass through the Platform’s servers and are not stored by the Platform.

13.3 Provision of Personal Information Outside Mainland China

The Platform operator is located in the Hong Kong Special Administrative Region, and some service providers used by the Platform are located outside mainland China. Your use of the Platform services therefore involves the provision of your personal information outside mainland China.

The relevant overseas recipients are as follows:

ICLICK INTERACTIVE ASIA LIMITED, located in the Hong Kong Special Administrative Region. The purposes are to provide Platform services, account administration, AI features, Points accounting, customer support and security. Processing includes storage, use, transmission and other processing necessary to provide the services. The categories of personal information received include account information, content you submit and generated results, transaction records, consumption logs, and Connection and access logs. You may contact this recipient using the privacy contact details in Section 12.
Stripe, Inc., located in the United States and potentially processing information in other countries or regions. The purposes are payment processing, refunds, payment-dispute handling and fraud prevention. Processing includes directly collecting payment information through Stripe-hosted checkout, verifying and processing transactions, returning transaction results to the Platform, and handling refunds and disputes. The categories of personal information received include payment information, transaction amount, payment-method type, transaction identifiers and information necessary for fraud prevention. See <https://stripe.com/privacy> for its privacy information and contact details.
OpenAI, L.L.C., located in the United States. The purpose is to complete AI tasks you initiate. Processing includes receiving and processing through APIs the inputs necessary to complete a task and returning generated results. The categories of personal information received include prompts, files, context necessary to complete the task and generated results. Our agreement with the provider prohibits it from using such content for model training. See <https://openai.com/policies/row-privacy-policy/> for its privacy information and contact details.
Amazon Web Services, Inc. (AWS), using a relevant service region located in Singapore. The purposes are to host and operate the Platform and store online Platform data. Processing includes cloud storage, operation, backup and processing necessary to maintain service availability. The categories of personal information received include account information, content you submit and generated results, order and Points records, transaction and service logs, and telemetry data. See <https://aws.amazon.com/privacy/> for its privacy information and contact details.
Cloudflare, Inc., located in the United States and providing services through global edge locations. The purposes are content delivery, edge protection, traffic access and rate limiting. Processing includes receiving, transmitting and analysing network requests at edge locations. The categories of personal information received include access IP addresses, TLS information and request metadata. See <https://www.cloudflare.com/privacypolicy/> for its privacy information and contact details.
Google LLC, located in the United States and potentially processing information in other countries or regions. The purposes are Google sign-in, identity verification and the delivery of login, account and support emails. Processing includes verifying identity through Google sign-in, returning necessary identity information to the Platform and sending email through Google Workspace. The categories of personal information received include account identifiers, email address, name, profile photo, authentication information, email-recipient address and relevant email content. See <https://policies.google.com/privacy> for its privacy information and contact details.
Microsoft Corporation, located in the United States and potentially processing information in other countries or regions. The purpose is to complete sign-in and identity verification through Microsoft Entra ID. Processing includes verifying identity through Microsoft sign-in and returning necessary identity information to the Platform. The categories of personal information received include account identifier, email address or UPN, name and authentication information. See <https://privacy.microsoft.com/privacystatement> for its privacy information and contact details.

Specific service providers and their locations may change with Platform features and service arrangements. If there is a material change to an overseas recipient, the purpose or method of processing, or the categories of personal information, the Platform will update this Policy or otherwise notify you as required by law and will obtain your separate consent again where legally required.

You may use the user-rights contact details in Section 12 to request the exercise of personal-information rights against an overseas recipient. The Platform will assist in forwarding and following up on your request.

Cross-border notice and separate consent: Before providing your personal information outside mainland China, the Platform will inform you, in accordance with Article 39 of the PIPL, of the overseas recipient’s name, contact details, purposes and methods of processing, categories of personal information, and the methods and procedures by which you may exercise your personal-information rights against the recipient, and will obtain your separate consent as required by law. You may withdraw that consent through the user-rights contact details in Section 12. However, because the Platform operator and recipients necessary to provide the core services are located outside mainland China, the Platform may be unable to continue providing the relevant services after you withdraw consent. Account closure and the treatment of unused Points are governed by the applicable Terms of Service and the MIA Points Refund Policy.

Cross-border procedures and assessment: The provision of personal information outside mainland China described above is necessary to conclude or perform a contract to which you are a party. Where the applicable conditions are met, the relevant transfers may be exempt from filing for a data-export security assessment, entering into the standard contract for the export of personal information or obtaining personal-information-protection certification. Such procedural exemptions do not relieve the Platform of its applicable obligations to provide notice, obtain separate consent and conduct a personal-information-protection impact assessment. The Platform has completed a personal-information-protection impact assessment for the relevant cross-border processing.

If the cross-border arrangements change, or if the scale of the Platform’s business, the types of data or the circumstances of the transfers require the Platform to file a standard contract for the export of personal information, obtain personal-information-protection certification, undergo a data-export security assessment or complete another procedure, the Platform will complete the applicable procedure and provide further notice as required by law.

13.4 Your Rights under the PIPL

In addition to the rights listed in Section 9, you have the following rights:

Right to be informed and to decide: You have the right to restrict or refuse the processing of your personal information.
Right of access and copying: You have the right to access and obtain a copy of your personal information from the Platform.
Rights to correction, completion and deletion: You have the right to request correction or completion of inaccurate or incomplete personal information and deletion in circumstances prescribed by law.
Right to portability: Where the conditions prescribed by the national cyberspace authority are met, you may request that your personal information be transferred to a personal-information processor you designate.
Right to an explanation: You have the right to request that the Platform explain its personal-information processing rules.
Rights of close relatives of a deceased person: For their own lawful and legitimate interests, the close relatives of a deceased natural person may exercise rights such as access, copying, correction and deletion in relation to the deceased person’s relevant personal information.

You may submit a request using the user-rights contact details in Section 12. The Platform will respond within 15 business days after receiving your request. If the Platform refuses your request, it will explain the reason.

13.5 Representative in Mainland China

In accordance with Article 53 of the PIPL, the Platform has designated the following representative in the People’s Republic of China:

Name: Carl Hu
Position: Data Protection Officer (DPO)
Contact: [email protected]

For questions, comments or complaints concerning the processing of personal information, you may also contact the Platform through the privacy contact details in Section 12. To exercise a personal-information right or request account closure, please use the user-rights contact details in Section 12.

13.6 Automated Decision-Making and Risk Management

The Platform’s risk-management system may perform automated risk assessments of top-up transactions, which may result in a transaction being held or declined (see Section 4.6 of the Terms of Service). Such assessments do not independently make final decisions that have a significant impact on your personal rights and interests. Decisions involving account restrictions are subject to human review. You have the right to request an explanation of the rules governing automated decision-making and to refuse a decision that has a significant impact on your personal rights and interests where that decision is made solely through automated decision-making.

13.7 Generative Artificial Intelligence Services

The Platform provides generative AI features by calling third-party model APIs. The Platform handles the inputs you submit and the results you receive when using those features as described in Sections 2.4 and 5. Such content may be stored to provide conversation history, cross-session memory, file-management and generated-result features, but it is not used for model training and is not unlawfully provided to other parties. You may request to exercise the applicable rights as described in Sections 9 and 12.

The Platform may label AI-generated content as required by applicable laws and regulations. See Section 5.5 of the Terms of Service for the relevant rules.

13.8 Complaints and Reports

If you believe that the Platform’s processing of personal information has infringed your rights, you may first submit a complaint through the privacy contact details in Section 12. You also have the right to complain or report the matter to the authority responsible for personal-information protection or to bring legal proceedings before a people’s court in accordance with law.